Civils

The Privacy Policy addresses only personal data, stating you own your information, but says nothing about ownership of uploaded construction drawings, documents, prompts, or project files — which are the core inputs to this product. The governing Terms of Service and EULA were inaccessible, so no input-data licence or ownership grant could be reviewed. This silence around the tool's primary asset (proprietary drawings) is a material gap.

The Privacy Policy does not address ownership of AI-generated outputs such as takeoffs, measurements, extracted borehole data, or annotated PDFs. No Terms of Service or EULA was accessible to establish who owns generated results. This is a significant gap for a tool whose deliverables are commercial estimating outputs.

The policy states that only anonymous usage data is used to improve services and is silent on whether uploaded documents, drawings, or prompts are used to train or fine-tune models. For an AI tool that ingests proprietary construction documents, the absence of any explicit no-training commitment is a notable risk. No enterprise or EULA text was available to clarify.

The policy provides a clear deletion pathway and a concrete 14-day deletion SLA once a request is confirmed, with retention tied to service provision. Data may be retained longer where legally required. There is no explicit schedule for security/audit-log retention, but the consumer-facing deletion commitment is above average.

The policy commits not to share personal information with outside parties except for legally compelled disclosures, absent explicit user permission. However, it does not name any sub-processors, cloud hosts, or third-party AI model providers, which an AI document-processing product almost certainly relies on. The internal inconsistency (referring to 'two categories' then 'three categories') creates ambiguity about the scope of sharing.

The policy provides explicit opt-out mechanisms for non-essential data, marketing communications, and cookies, including email unsubscribe links and account settings controls. Declining non-essential data carries no consequences to access. These are meaningful, clearly stated opt-out rights.

The policy claims compliance with GDPR and Singapore data laws but names no third-party attestations or certifications. No SOC 2, ISO 27001, ISO 27018, ISO 42001, NIST CSF, or EU AI Act references appear. For an enterprise SaaS tool the absence of any audited certification means claims rest on self-assertion only.

The Privacy Policy is entirely silent on model transparency, explainability, or enterprise audit rights. No accessible document describes how AI decisions are made, logged, or reviewed at a systems level. This silence is a risk for a tool producing commercial measurements and compliance checks.

The policy discloses TLS-secured connections, security software/virus scanners, and email-authentication standards (DKIM/SPF/DMARC), but does not mention encryption at rest, access controls, penetration testing, bug bounties, or incident response. No breach history is disclosed and no dedicated security page or trust center is referenced. The disclosed controls are minimal for an enterprise document-processing platform.

The single Privacy Policy applies to the website and services generally and does not distinguish free from paid or enterprise tiers. No enterprise agreement, MSA, or DPA was accessible to determine whether business customers receive stronger data-handling terms. The delta cannot be assessed from the available text.

The Privacy Policy does not address whether staff may read user prompts, uploaded documents, or outputs. The product surface indicates a QA team reviews and verifies AI measurements, implying human access to user-uploaded drawings, but the policy itself contains no disclosure or control governing such review. This gap between apparent practice and policy silence is a concern.

The policy states it will comply with legal requests from courts, judges, or law enforcement, and may do so without user permission or notice. No pending litigation or transparency reporting is disclosed. The no-notice disclosure provision is common but user-unfavorable.

The policy states it collects email address and payment information as identifiable PII, plus anonymized usage data via optional cookies. It does not inventory the contents of uploaded documents (which may contain project, site, or personnel data) and does not clearly enumerate device identifiers or IP data. Payment/financial data is collected, and disclosure is adequate for the named PII but incomplete regarding document contents.

No effective date, published date, or last-updated date appears anywhere in the Privacy Policy, so recency cannot be established. The product is explicitly AI-first (AI takeoffs, AI agents, document extraction), yet the policy never mentions AI/ML processing, model training, or third-party model providers. The combination of no discoverable date and no coverage of the AI capabilities the product ships justifies a RED rating.

Only one document (the Privacy Policy) was retrievable, so a cross-document consistency check across Terms, DPA, or security pages is impossible. Within the single document there is a minor internal inconsistency (referring to 'two categories' then 'three categories' of disclosure), which is not a cross-document contradiction. No cross-document contradictions can be asserted.